✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
UNC6148 Installs OVERSTEP Backdoor in SonicWall SMA Devices: 2024 APT Breach Analysis
In early 2024, a sophisticated threat actor group identified as UNC6148 targeted SonicWall Secure Mobile Access (SMA) appliances with a newly discovered backdoor malware named 'OVERSTEP'. By exploiting unpatched vulnerabilities, attackers gained unauthorized access, deployed persistent hidden software, exfiltrated credentials, and established remote control over affected devices. The compromise allowed lateral movement within victim networks, providing attackers with ongoing access to sensitive data and resources while evading detection for extended periods. Organizations using SonicWall SMA were particularly at risk of operational disruptions, data breaches, and unauthorized exposure of business-critical systems. This incident exemplifies the growing trend of supply-chain and edge-device attacks by advanced persistent threats (APTs). The deployment of stealthy backdoors like OVERSTEP signals increased sophistication and automation among threat actors, further pressuring organizations to improve detection, patch management, and east-west segmentation strategies.
6 months ago
Kill Chain
Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova
In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections. This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.
6 months ago
Kill Chain
Brickstorm: The Next-Level Chinese APT Breach Impacting SaaS & Legal Sectors in 2025
In 2025, a highly sophisticated cyberespionage campaign attributed to a suspected Chinese advanced persistent threat (APT), utilizing malware later dubbed 'Brickstorm,' successfully infiltrated multiple US legal services and tech supply chain organizations. The attackers leveraged undisclosed zero-day vulnerabilities to gain initial access, maintain exceptional stealth with average dwell times of over 400 days, and move laterally into downstream customers. Their campaign targeted proprietary source code and sensitive trade/national security intelligence, making detection challenging through advanced cleanup techniques and non-overlapping infrastructure. This incident is particularly significant as it represents a new echelon of APT supply chain intrusions, echoing a rise in strategic, multi-year campaigns focusing on SaaS and cloud intermediaries. It highlights the growing need for robust east-west visibility, zero trust segmentation, and supply chain security amid evolving TTPs that routinely outpace traditional detection and response capabilities.
6 months ago
Kill Chain
UNC6148 Rootkit Attack on SonicWall SMA100 Devices in 2025
In September 2025, SonicWall released a critical firmware update for its SMA 100 series products in response to a sophisticated attack campaign orchestrated by threat actor UNC6148. This incident involved the deployment of the OVERSTEP user-mode rootkit on end-of-life SMA 100 devices, providing persistent unauthorized access, stealing sensitive configuration and certificate data, and enabling lateral movement. Attackers exploited vulnerabilities in legacy firmware to maintain remote access—even post firmware upgrades—compromising credentials, OTP seeds, and digital certificates, with notable overlaps to prior Abyss ransomware operations. The incident underscores the growing threat posed by ransomware groups leveraging supply chain devices and persistent malware in network appliances. With a surge in rootkit-enabled persistence and a rise in zero-day exploitations targeting network edge devices, organizations must prioritize timely patching and end-of-life device management to curb risk exposure.
6 months ago
Kill Chain
Cloudflare Thwarts Record-Breaking 22.2 Tbps DDoS Assault in 2025
In September 2025, Cloudflare successfully mitigated a record-breaking Distributed Denial-of-Service (DDoS) attack that peaked at 22.2 Tbps and 10.6 billion packets per second. Orchestrated over just 40 seconds, the massive volumetric attack overwhelmed network infrastructure, pushing the limits of firewalls, routers, and load balancers. Prior research links recent large-scale DDoS campaigns—including those hitting Cloudflare—to the AISURU botnet, which leveraged a sudden increase in infected devices globally, stemming in part from exploited router firmware vulnerabilities. Business impact was minimized due to Cloudflare’s rapid mitigation, but the attack underscores the ever-increasing scale and sophistication of DDoS threats. Record-breaking DDoS attacks are climbing in frequency and intensity, with attackers exploiting IoT vulnerabilities and leveraging formidable botnets. This surge highlights the urgent need for resilient, scalable mitigation strategies, and amplifies ongoing regulatory and industry pressure to strengthen defenses against large-scale infrastructure threats.
6 months ago
Kill Chain
State-Sponsored Command Injection Breach Targets Libraesva ESG in 2025
In September 2025, Libraesva, a widely used email security gateway provider, identified and patched a medium-severity vulnerability, CVE-2025-59689, actively exploited by a state-sponsored threat actor. The flaw involved improper sanitization in the handling of compressed email attachments, allowing attackers to execute arbitrary shell commands from non-privileged user accounts. The exploit targeted a specific appliance, highlighting both the technical skill and tactical precision of the attacker. Libraesva’s emergency fix was deployed within 17 hours to cloud and on-premise environments, and an automated scan for indicators of compromise was also released. Organizations running unsupported product versions must upgrade manually to remain protected. This incident exemplifies the growing sophistication and focus of state-linked adversaries exploiting command injection flaws in trusted security layers like email gateways. As supply-chain and infrastructure-focused attacks increase across sectors, organizations face mounting regulatory and operational pressure to maintain up-to-date security and swift response mechanisms.
6 months ago
Kill Chain
BadIIS Malware Spreads via SEO Poisoning in Operation Rewrite
In September 2025, cybersecurity analysts uncovered a targeted campaign in East and Southeast Asia, particularly Vietnam, orchestrated by a Chinese-speaking threat actor dubbed CL-UNK-1037. Using a custom malware named BadIIS, the group launched "Operation Rewrite" by employing SEO poisoning to direct unsuspecting users to compromised websites. These sites served as a launch point for deploying BadIIS, which stealthily redirected traffic, established persistent web shells, and enabled lateral movement within infected infrastructure. The attacks leveraged trusted search results to compromise both organizations and individuals, aiming to establish long-term footholds and facilitate future malicious operations. This incident highlights the increasing sophistication of adversaries leveraging advanced social engineering and technical tactics like SEO poisoning. The blending of supply chain and web application compromise with persistent malware demonstrates evolving TTPs that bypass conventional detection, emphasizing the urgent need for multilayered security and continuous vigilance for all organizations.
6 months ago
Kill Chain
SolarWinds 2025 RCE Flaw: What CVE-2025-26399 Means for Enterprise Security
In September 2025, SolarWinds disclosed a critical vulnerability (CVE-2025-26399, CVSS 9.8) in its Web Help Desk software, allowing remote code execution via deserialization of untrusted data. Attackers could exploit this flaw to execute arbitrary commands on affected systems, potentially leading to full compromise of customer environments. SolarWinds released urgent hotfixes to address the flaw after it was identified during routine security testing, emphasizing the risk to organizations running unpatched instances exposed to the internet. This incident underscores the persistent threat posed by software supply chain vulnerabilities and insecure coding practices in widely used IT management platforms. With high-profile supply chain attacks on the rise, rapid vulnerability disclosure and patching are now critical to minimizing both direct exploitation and regulatory exposure.
6 months ago
Kill Chain
US Secret Service Seizes Massive SIM Server Network Threatening Government Officials
In September 2025, the U.S. Secret Service announced it had dismantled a large-scale illicit telecommunications infrastructure across the New York tri-state area, seizing over 300 SIM servers and 100,000 SIM cards. These devices, co-located at multiple sites, were used by unknown malicious actors to facilitate threats against U.S. government officials, particularly near the United Nations. Investigators discovered that this network enabled covert communications and potentially enabled bypasses of monitoring controls, raising national security concerns. The takedown required coordinated federal action to secure the assets, neutralize the risk, and support ongoing intelligence operations. This incident highlights the ongoing evolution and physical sophistication of threat actor infrastructure, especially targeting high-profile government personnel. The scale and automation facilitated by such hardware underline the growing intersection of physical and cyber threats and serve as a wake-up call for risk teams facing advanced, hybrid attack models.
6 months ago
Kill Chain
Supermicro BMC Supply-Chain Bugs Reveal Firmware Trust Weaknesses in 2025
In September 2025, researchers unveiled two medium-severity vulnerabilities affecting Supermicro's Baseboard Management Controller (BMC) firmware. Attackers could leverage improper cryptographic signature validation to bypass root-of-trust controls, allowing the deployment of malicious firmware images through supply-chain vectors. The flaws enable an adversary to compromise hardware integrity, potentially resulting in persistent access, data exfiltration, and disruption within enterprise server environments. Supermicro promptly released firmware updates and provided mitigation guidance as exploitation risks became public. This incident reflects an unsettling rise in supply-chain attacks targeting device firmware and hardware trust anchors. It underscores both the growing sophistication of attacker techniques and the criticality of maintaining robust verification, anomaly detection, and real-time firmware integrity validation for modern IT infrastructure.
6 months ago
Kill Chain
Iranian APT Extends Reach: 2024 Nimbus Manticore Malware Hits Europe
In early 2024, a sophisticated Iran-backed threat group known as “Nimbus Manticore” launched targeted cyberattacks against several European organizations using enhanced variants of its custom malware. The attackers leveraged spear-phishing emails embedding malicious attachments as their initial access vector, resulting in the deployment of advanced payloads that enabled persistent access and lateral movement within affected networks. Once inside, the group utilized encrypted communication channels and east-west movement to exfiltrate sensitive data and evade common detection mechanisms. The incident has caused operational disruptions and triggered regulatory notifications in multiple EU member states. This breach illustrates a strategic expansion of Iran-linked APT operations beyond their traditional region, pointing to escalating risks for European enterprises. The exposed techniques underscore the necessity for advanced detection, robust internal segmentation, and regulatory alignment as attackers increasingly shift tactics to bypass perimeter controls.
6 months ago
Kill Chain
Operation Rewrite: 2025 Chinese-Speaking Threat Actor Turns BadIIS Modules into Weaponized SEO Poisons
In March 2025, cybersecurity researchers uncovered Operation Rewrite, a large-scale search engine optimization (SEO) poisoning campaign attributed to a Chinese-speaking threat actor tracked as CL-UNK-1037, with links to Group 9 and DragonRank. Attackers compromised web and application servers, deploying malicious native IIS modules dubbed "BadIIS" to intercept, modify, and proxy web traffic. By injecting SEO content and redirecting legitimate visitors, the attackers increased rankings for illicit sites, harvested sensitive data, and exfiltrated web application source code. Multiple server types—web servers, domain controllers, and high-value hosts—were compromised, indicating substantial operational impact and risk to affected organizations and individuals.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports